Re: [PATCH net v2 2/2] net/smc: fix LGR and link use-after-free issue

Alexandra Winter
2024-11-29T13:29:16Z

On 27.11.24 14:30, Wen Gu wrote:
> net/smc/af_smc.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
> index ed6d4d520bc7..9e6c69d18581 100644
> --- a/net/smc/af_smc.c
> +++ b/net/smc/af_smc.c
> @@ -1900,6 +1900,7 @@ static void smc_listen_out(struct smc_sock *new_smc)
> if (tcp_sk(new_smc->clcsock->sk)->syn_smc)
> atomic_dec(&lsmc->queued_smc_hs);
>
> + release_sock(newsmcsk); /* lock in smc_listen_work() */
> if (lsmc->sk.sk_state == SMC_LISTEN) {
> lock_sock_nested(&lsmc->sk, SINGLE_DEPTH_NESTING);
> smc_accept_enqueue(&lsmc->sk, newsmcsk);
> @@ -2421,6 +2422,7 @@ static void smc_listen_work(struct work_struct *work)
> u8 accept_version;
> int rc = 0;
>
> + lock_sock(&new_smc->sk); /* release in smc_listen_out() */
> if (new_smc->listen_smc->sk.sk_state != SMC_LISTEN)
> return smc_listen_out_err(new_smc);
>

As far as I can tell, this looks good to me.
Unfortunately I don't understand the dependencies between the different SMC sockets and TCP sockets
well enough to give an R-b.